|
|
34bc20 |
From 48f126157d36962e458bf12f90b50cfcef26eee9 Mon Sep 17 00:00:00 2001
|
|
|
34bc20 |
From: Daniel Stenberg <daniel@haxx.se>
|
|
|
34bc20 |
Date: Mon, 25 Apr 2022 16:24:33 +0200
|
|
|
34bc20 |
Subject: [PATCH 1/4] connect: store "conn_remote_port" in the info struct
|
|
|
34bc20 |
|
|
|
34bc20 |
To make it available after the connection ended.
|
|
|
34bc20 |
|
|
|
34bc20 |
Upstream-commit: 08b8ef4e726ba10f45081ecda5b3cea788d3c839
|
|
|
34bc20 |
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
|
|
34bc20 |
---
|
|
|
34bc20 |
lib/connect.c | 1 +
|
|
|
34bc20 |
lib/urldata.h | 6 +++++-
|
|
|
34bc20 |
2 files changed, 6 insertions(+), 1 deletion(-)
|
|
|
34bc20 |
|
|
|
34bc20 |
diff --git a/lib/connect.c b/lib/connect.c
|
|
|
34bc20 |
index f724646..12a8aae 100644
|
|
|
34bc20 |
--- a/lib/connect.c
|
|
|
34bc20 |
+++ b/lib/connect.c
|
|
|
34bc20 |
@@ -614,6 +614,7 @@ void Curl_persistconninfo(struct connectdata *conn)
|
|
|
34bc20 |
conn->data->info.conn_scheme = conn->handler->scheme;
|
|
|
34bc20 |
conn->data->info.conn_protocol = conn->handler->protocol;
|
|
|
34bc20 |
conn->data->info.conn_primary_port = conn->primary_port;
|
|
|
34bc20 |
+ conn->data->info.conn_remote_port = conn->remote_port;
|
|
|
34bc20 |
conn->data->info.conn_local_port = conn->local_port;
|
|
|
34bc20 |
}
|
|
|
34bc20 |
|
|
|
34bc20 |
diff --git a/lib/urldata.h b/lib/urldata.h
|
|
|
34bc20 |
index 4bb0a84..cadf0e5 100644
|
|
|
34bc20 |
--- a/lib/urldata.h
|
|
|
34bc20 |
+++ b/lib/urldata.h
|
|
|
34bc20 |
@@ -1050,7 +1050,11 @@ struct PureInfo {
|
|
|
34bc20 |
reused, in the connection cache. */
|
|
|
34bc20 |
|
|
|
34bc20 |
char conn_primary_ip[MAX_IPADR_LEN];
|
|
|
34bc20 |
- long conn_primary_port;
|
|
|
34bc20 |
+ long conn_primary_port;/* this is the destination port to the connection,
|
|
|
34bc20 |
+ which might have been a proxy */
|
|
|
34bc20 |
+ int conn_remote_port; /* this is the "remote port", which is the port
|
|
|
34bc20 |
+ number of the used URL, independent of proxy or
|
|
|
34bc20 |
+ not */
|
|
|
34bc20 |
|
|
|
34bc20 |
char conn_local_ip[MAX_IPADR_LEN];
|
|
|
34bc20 |
long conn_local_port;
|
|
|
34bc20 |
--
|
|
|
34bc20 |
2.34.1
|
|
|
34bc20 |
|
|
|
34bc20 |
|
|
|
34bc20 |
From 6307fa6f9784402ba58697f46ba04354225391b7 Mon Sep 17 00:00:00 2001
|
|
|
34bc20 |
From: Daniel Stenberg <daniel@haxx.se>
|
|
|
34bc20 |
Date: Mon, 25 Apr 2022 16:24:33 +0200
|
|
|
34bc20 |
Subject: [PATCH 2/4] transfer: redirects to other protocols or ports clear
|
|
|
34bc20 |
auth
|
|
|
34bc20 |
|
|
|
34bc20 |
... unless explicitly permitted.
|
|
|
34bc20 |
|
|
|
34bc20 |
Bug: https://curl.se/docs/CVE-2022-27774.html
|
|
|
34bc20 |
Reported-by: Harry Sintonen
|
|
|
34bc20 |
Closes #8748
|
|
|
34bc20 |
|
|
|
34bc20 |
Upstream-commit: 620ea21410030a9977396b4661806bc187231b79
|
|
|
34bc20 |
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
|
|
34bc20 |
---
|
|
|
34bc20 |
lib/transfer.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
|
34bc20 |
lib/url.c | 27 ++++++++++++++--------
|
|
|
34bc20 |
lib/urldata.h | 1 +
|
|
|
34bc20 |
3 files changed, 81 insertions(+), 10 deletions(-)
|
|
|
34bc20 |
|
|
|
34bc20 |
diff --git a/lib/transfer.c b/lib/transfer.c
|
|
|
34bc20 |
index ad5a7ba..2022cba 100644
|
|
|
34bc20 |
--- a/lib/transfer.c
|
|
|
34bc20 |
+++ b/lib/transfer.c
|
|
|
34bc20 |
@@ -1370,6 +1370,7 @@ CURLcode Curl_pretransfer(struct Curl_easy *data)
|
|
|
34bc20 |
data->state.wildcardmatch = data->set.wildcard_enabled;
|
|
|
34bc20 |
data->set.followlocation = 0; /* reset the location-follow counter */
|
|
|
34bc20 |
data->state.this_is_a_follow = FALSE; /* reset this */
|
|
|
34bc20 |
+ data->state.this_is_a_follow_without_auth = FALSE;
|
|
|
34bc20 |
data->state.errorbuf = FALSE; /* no error has occurred */
|
|
|
34bc20 |
data->state.httpversion = 0; /* don't assume any particular server version */
|
|
|
34bc20 |
|
|
|
34bc20 |
@@ -1554,6 +1555,68 @@ CURLcode Curl_follow(struct Curl_easy *data,
|
|
|
34bc20 |
|
|
|
34bc20 |
}
|
|
|
34bc20 |
|
|
|
34bc20 |
+ /* Clear auth if this redirects to a different port number or protocol,
|
|
|
34bc20 |
+ unless permitted */
|
|
|
34bc20 |
+ if(!data->set.allow_auth_to_other_hosts && (type != FOLLOW_FAKE)) {
|
|
|
34bc20 |
+ int port;
|
|
|
34bc20 |
+ bool clear = FALSE;
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+ CURLU *u = curl_url();
|
|
|
34bc20 |
+ if(!u)
|
|
|
34bc20 |
+ return CURLE_OUT_OF_MEMORY;
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+ uc = curl_url_set(u, CURLUPART_URL, newurl,
|
|
|
34bc20 |
+ ((type == FOLLOW_REDIR) ? CURLU_URLENCODE : 0));
|
|
|
34bc20 |
+ if(uc) {
|
|
|
34bc20 |
+ infof(data, "Clear auth, curl_url_set() failed\n");
|
|
|
34bc20 |
+ clear = TRUE;
|
|
|
34bc20 |
+ }
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+ if(!clear) {
|
|
|
34bc20 |
+ if(data->set.use_port && data->state.allow_port)
|
|
|
34bc20 |
+ /* a custom port is used */
|
|
|
34bc20 |
+ port = (int)data->set.use_port;
|
|
|
34bc20 |
+ else {
|
|
|
34bc20 |
+ char *portnum;
|
|
|
34bc20 |
+ uc = curl_url_get(u, CURLUPART_PORT, &portnum, CURLU_DEFAULT_PORT);
|
|
|
34bc20 |
+ if(uc) {
|
|
|
34bc20 |
+ infof(data, "Clear auth, failed to parse port number\n");
|
|
|
34bc20 |
+ clear = TRUE;
|
|
|
34bc20 |
+ }
|
|
|
34bc20 |
+ else {
|
|
|
34bc20 |
+ port = atoi(portnum);
|
|
|
34bc20 |
+ free(portnum);
|
|
|
34bc20 |
+ }
|
|
|
34bc20 |
+ }
|
|
|
34bc20 |
+ }
|
|
|
34bc20 |
+ if(!clear && port != data->info.conn_remote_port) {
|
|
|
34bc20 |
+ infof(data, "Clear auth, redirects to port from %u to %u\n",
|
|
|
34bc20 |
+ data->info.conn_remote_port, port);
|
|
|
34bc20 |
+ clear = TRUE;
|
|
|
34bc20 |
+ }
|
|
|
34bc20 |
+ if(!clear) {
|
|
|
34bc20 |
+ char *scheme;
|
|
|
34bc20 |
+ const struct Curl_handler *p;
|
|
|
34bc20 |
+ uc = curl_url_get(u, CURLUPART_SCHEME, &scheme, 0);
|
|
|
34bc20 |
+ if(uc) {
|
|
|
34bc20 |
+ infof(data, "Clear auth, failed to parse scheme\n");
|
|
|
34bc20 |
+ clear = TRUE;
|
|
|
34bc20 |
+ }
|
|
|
34bc20 |
+ else {
|
|
|
34bc20 |
+ p = Curl_builtin_scheme(scheme);
|
|
|
34bc20 |
+ if(p && (p->protocol != data->info.conn_protocol)) {
|
|
|
34bc20 |
+ infof(data, "Clear auth, redirects scheme from %s to %s\n",
|
|
|
34bc20 |
+ data->info.conn_scheme, scheme);
|
|
|
34bc20 |
+ clear = TRUE;
|
|
|
34bc20 |
+ }
|
|
|
34bc20 |
+ free(scheme);
|
|
|
34bc20 |
+ }
|
|
|
34bc20 |
+ }
|
|
|
34bc20 |
+ if(clear)
|
|
|
34bc20 |
+ data->state.this_is_a_follow_without_auth = TRUE;
|
|
|
34bc20 |
+ curl_url_cleanup(u);
|
|
|
34bc20 |
+ }
|
|
|
34bc20 |
+
|
|
|
34bc20 |
if(type == FOLLOW_FAKE) {
|
|
|
34bc20 |
/* we're only figuring out the new url if we would've followed locations
|
|
|
34bc20 |
but now we're done so we can get out! */
|
|
|
34bc20 |
diff --git a/lib/url.c b/lib/url.c
|
|
|
34bc20 |
index ed3c933..7dd5267 100644
|
|
|
34bc20 |
--- a/lib/url.c
|
|
|
34bc20 |
+++ b/lib/url.c
|
|
|
34bc20 |
@@ -3483,18 +3483,25 @@ static CURLcode override_login(struct Curl_easy *data,
|
|
|
34bc20 |
struct connectdata *conn,
|
|
|
34bc20 |
char **userp, char **passwdp, char **optionsp)
|
|
|
34bc20 |
{
|
|
|
34bc20 |
- if(data->set.str[STRING_USERNAME]) {
|
|
|
34bc20 |
- free(*userp);
|
|
|
34bc20 |
- *userp = strdup(data->set.str[STRING_USERNAME]);
|
|
|
34bc20 |
- if(!*userp)
|
|
|
34bc20 |
- return CURLE_OUT_OF_MEMORY;
|
|
|
34bc20 |
+ if(data->state.this_is_a_follow
|
|
|
34bc20 |
+ && data->state.this_is_a_follow_without_auth)
|
|
|
34bc20 |
+ {
|
|
|
34bc20 |
+ conn->bits.user_passwd = FALSE;
|
|
|
34bc20 |
}
|
|
|
34bc20 |
+ else {
|
|
|
34bc20 |
+ if(data->set.str[STRING_USERNAME]) {
|
|
|
34bc20 |
+ free(*userp);
|
|
|
34bc20 |
+ *userp = strdup(data->set.str[STRING_USERNAME]);
|
|
|
34bc20 |
+ if(!*userp)
|
|
|
34bc20 |
+ return CURLE_OUT_OF_MEMORY;
|
|
|
34bc20 |
+ }
|
|
|
34bc20 |
|
|
|
34bc20 |
- if(data->set.str[STRING_PASSWORD]) {
|
|
|
34bc20 |
- free(*passwdp);
|
|
|
34bc20 |
- *passwdp = strdup(data->set.str[STRING_PASSWORD]);
|
|
|
34bc20 |
- if(!*passwdp)
|
|
|
34bc20 |
- return CURLE_OUT_OF_MEMORY;
|
|
|
34bc20 |
+ if(data->set.str[STRING_PASSWORD]) {
|
|
|
34bc20 |
+ free(*passwdp);
|
|
|
34bc20 |
+ *passwdp = strdup(data->set.str[STRING_PASSWORD]);
|
|
|
34bc20 |
+ if(!*passwdp)
|
|
|
34bc20 |
+ return CURLE_OUT_OF_MEMORY;
|
|
|
34bc20 |
+ }
|
|
|
34bc20 |
}
|
|
|
34bc20 |
|
|
|
34bc20 |
if(data->set.str[STRING_OPTIONS]) {
|
|
|
34bc20 |
diff --git a/lib/urldata.h b/lib/urldata.h
|
|
|
34bc20 |
index cadf0e5..026684b 100644
|
|
|
34bc20 |
--- a/lib/urldata.h
|
|
|
34bc20 |
+++ b/lib/urldata.h
|
|
|
34bc20 |
@@ -1234,6 +1234,7 @@ struct UrlState {
|
|
|
34bc20 |
curl_off_t current_speed; /* the ProgressShow() function sets this,
|
|
|
34bc20 |
bytes / second */
|
|
|
34bc20 |
bool this_is_a_follow; /* this is a followed Location: request */
|
|
|
34bc20 |
+ bool this_is_a_follow_without_auth;
|
|
|
34bc20 |
bool refused_stream; /* this was refused, try again */
|
|
|
34bc20 |
|
|
|
34bc20 |
/* host name, port number and protocol of the first (not followed) request.
|
|
|
34bc20 |
--
|
|
|
34bc20 |
2.34.1
|
|
|
34bc20 |
|
|
|
34bc20 |
|
|
|
34bc20 |
From b142f97840dfb033a1776d5a2986385da7753224 Mon Sep 17 00:00:00 2001
|
|
|
34bc20 |
From: Daniel Stenberg <daniel@haxx.se>
|
|
|
34bc20 |
Date: Mon, 25 Apr 2022 16:24:33 +0200
|
|
|
34bc20 |
Subject: [PATCH 3/4] tests: verify the fix for CVE-2022-27774
|
|
|
34bc20 |
|
|
|
34bc20 |
- Test 973 redirects from HTTP to FTP, clear auth
|
|
|
34bc20 |
- Test 974 redirects from HTTP to HTTP different port, clear auth
|
|
|
34bc20 |
- Test 975 redirects from HTTP to FTP, permitted to keep auth
|
|
|
34bc20 |
- Test 976 redirects from HTTP to HTTP different port, permitted to keep
|
|
|
34bc20 |
auth
|
|
|
34bc20 |
|
|
|
34bc20 |
Upstream-commit: 5295e8d64ac6949ecb3f9e564317a608f51b90d8
|
|
|
34bc20 |
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
|
|
34bc20 |
---
|
|
|
34bc20 |
tests/data/Makefile.inc | 1 +
|
|
|
34bc20 |
tests/data/test973 | 90 +++++++++++++++++++++++++++++++++++++++++
|
|
|
34bc20 |
tests/data/test974 | 88 ++++++++++++++++++++++++++++++++++++++++
|
|
|
34bc20 |
tests/data/test975 | 90 +++++++++++++++++++++++++++++++++++++++++
|
|
|
34bc20 |
tests/data/test976 | 89 ++++++++++++++++++++++++++++++++++++++++
|
|
|
34bc20 |
5 files changed, 358 insertions(+)
|
|
|
34bc20 |
create mode 100644 tests/data/test973
|
|
|
34bc20 |
create mode 100644 tests/data/test974
|
|
|
34bc20 |
create mode 100644 tests/data/test975
|
|
|
34bc20 |
create mode 100644 tests/data/test976
|
|
|
34bc20 |
|
|
|
34bc20 |
diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
|
|
|
34bc20 |
index 58c9e31..6c920ff 100644
|
|
|
34bc20 |
--- a/tests/data/Makefile.inc
|
|
|
34bc20 |
+++ b/tests/data/Makefile.inc
|
|
|
34bc20 |
@@ -108,6 +108,7 @@ test927 test928 test929 test930 test931 test932 test933 test934 test935 \
|
|
|
34bc20 |
test936 test937 test938 test939 test940 test941 test942 test943 test944 \
|
|
|
34bc20 |
test945 test946 test947 test948 test949 test950 test951 test952 \
|
|
|
34bc20 |
\
|
|
|
34bc20 |
+test973 test974 test975 test976 \
|
|
|
34bc20 |
test980 test981 test982 test983 test984 test985 test986 \
|
|
|
34bc20 |
\
|
|
|
34bc20 |
test1000 test1001 test1002 test1003 test1004 test1005 test1006 test1007 \
|
|
|
34bc20 |
diff --git a/tests/data/test973 b/tests/data/test973
|
|
|
34bc20 |
new file mode 100644
|
|
|
34bc20 |
index 0000000..6fe6ce0
|
|
|
34bc20 |
--- /dev/null
|
|
|
34bc20 |
+++ b/tests/data/test973
|
|
|
34bc20 |
@@ -0,0 +1,90 @@
|
|
|
34bc20 |
+<testcase>
|
|
|
34bc20 |
+<info>
|
|
|
34bc20 |
+<keywords>
|
|
|
34bc20 |
+HTTP
|
|
|
34bc20 |
+FTP
|
|
|
34bc20 |
+--location
|
|
|
34bc20 |
+</keywords>
|
|
|
34bc20 |
+</info>
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+#
|
|
|
34bc20 |
+# Server-side
|
|
|
34bc20 |
+<reply>
|
|
|
34bc20 |
+<data>
|
|
|
34bc20 |
+HTTP/1.1 301 redirect
|
|
|
34bc20 |
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
|
|
34bc20 |
+Server: test-server/fake
|
|
|
34bc20 |
+Content-Length: 0
|
|
|
34bc20 |
+Connection: close
|
|
|
34bc20 |
+Content-Type: text/html
|
|
|
34bc20 |
+Location: ftp://127.0.0.1:8992/a/path/9730002
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+</data>
|
|
|
34bc20 |
+<data2>
|
|
|
34bc20 |
+data
|
|
|
34bc20 |
+ to
|
|
|
34bc20 |
+ see
|
|
|
34bc20 |
+that FTP
|
|
|
34bc20 |
+works
|
|
|
34bc20 |
+ so does it?
|
|
|
34bc20 |
+</data2>
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+<datacheck>
|
|
|
34bc20 |
+HTTP/1.1 301 redirect
|
|
|
34bc20 |
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
|
|
34bc20 |
+Server: test-server/fake
|
|
|
34bc20 |
+Content-Length: 0
|
|
|
34bc20 |
+Connection: close
|
|
|
34bc20 |
+Content-Type: text/html
|
|
|
34bc20 |
+Location: ftp://127.0.0.1:8992/a/path/9730002
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+data
|
|
|
34bc20 |
+ to
|
|
|
34bc20 |
+ see
|
|
|
34bc20 |
+that FTP
|
|
|
34bc20 |
+works
|
|
|
34bc20 |
+ so does it?
|
|
|
34bc20 |
+</datacheck>
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+</reply>
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+#
|
|
|
34bc20 |
+# Client-side
|
|
|
34bc20 |
+<client>
|
|
|
34bc20 |
+<server>
|
|
|
34bc20 |
+http
|
|
|
34bc20 |
+ftp
|
|
|
34bc20 |
+</server>
|
|
|
34bc20 |
+ <name>
|
|
|
34bc20 |
+HTTP with auth redirected to FTP w/o auth
|
|
|
34bc20 |
+ </name>
|
|
|
34bc20 |
+ <command>
|
|
|
34bc20 |
+http://%HOSTIP:%HTTPPORT/973 -L -u joe:secret
|
|
|
34bc20 |
+</command>
|
|
|
34bc20 |
+</client>
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+#
|
|
|
34bc20 |
+# Verify data after the test has been "shot"
|
|
|
34bc20 |
+<verify>
|
|
|
34bc20 |
+<strip>
|
|
|
34bc20 |
+^User-Agent:.*
|
|
|
34bc20 |
+</strip>
|
|
|
34bc20 |
+<protocol>
|
|
|
34bc20 |
+GET /973 HTTP/1.1
|
|
|
34bc20 |
+Host: %HOSTIP:%HTTPPORT
|
|
|
34bc20 |
+Authorization: Basic am9lOnNlY3JldA==
|
|
|
34bc20 |
+Accept: */*
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+USER anonymous
|
|
|
34bc20 |
+PASS ftp@example.com
|
|
|
34bc20 |
+PWD
|
|
|
34bc20 |
+CWD a
|
|
|
34bc20 |
+CWD path
|
|
|
34bc20 |
+EPSV
|
|
|
34bc20 |
+TYPE I
|
|
|
34bc20 |
+SIZE 9730002
|
|
|
34bc20 |
+RETR 9730002
|
|
|
34bc20 |
+QUIT
|
|
|
34bc20 |
+</protocol>
|
|
|
34bc20 |
+</verify>
|
|
|
34bc20 |
+</testcase>
|
|
|
34bc20 |
diff --git a/tests/data/test974 b/tests/data/test974
|
|
|
34bc20 |
new file mode 100644
|
|
|
34bc20 |
index 0000000..de02d89
|
|
|
34bc20 |
--- /dev/null
|
|
|
34bc20 |
+++ b/tests/data/test974
|
|
|
34bc20 |
@@ -0,0 +1,88 @@
|
|
|
34bc20 |
+<testcase>
|
|
|
34bc20 |
+<info>
|
|
|
34bc20 |
+<keywords>
|
|
|
34bc20 |
+HTTP
|
|
|
34bc20 |
+--location
|
|
|
34bc20 |
+</keywords>
|
|
|
34bc20 |
+</info>
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+#
|
|
|
34bc20 |
+# Server-side
|
|
|
34bc20 |
+<reply>
|
|
|
34bc20 |
+<data>
|
|
|
34bc20 |
+HTTP/1.1 301 redirect
|
|
|
34bc20 |
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
|
|
34bc20 |
+Server: test-server/fake
|
|
|
34bc20 |
+Content-Length: 0
|
|
|
34bc20 |
+Connection: close
|
|
|
34bc20 |
+Content-Type: text/html
|
|
|
34bc20 |
+Location: http://firsthost.com:9999/a/path/9740002
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+</data>
|
|
|
34bc20 |
+<data2>
|
|
|
34bc20 |
+HTTP/1.1 200 OK
|
|
|
34bc20 |
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
|
|
34bc20 |
+Server: test-server/fake
|
|
|
34bc20 |
+Content-Length: 4
|
|
|
34bc20 |
+Connection: close
|
|
|
34bc20 |
+Content-Type: text/html
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+hey
|
|
|
34bc20 |
+</data2>
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+<datacheck>
|
|
|
34bc20 |
+HTTP/1.1 301 redirect
|
|
|
34bc20 |
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
|
|
34bc20 |
+Server: test-server/fake
|
|
|
34bc20 |
+Content-Length: 0
|
|
|
34bc20 |
+Connection: close
|
|
|
34bc20 |
+Content-Type: text/html
|
|
|
34bc20 |
+Location: http://firsthost.com:9999/a/path/9740002
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+HTTP/1.1 200 OK
|
|
|
34bc20 |
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
|
|
34bc20 |
+Server: test-server/fake
|
|
|
34bc20 |
+Content-Length: 4
|
|
|
34bc20 |
+Connection: close
|
|
|
34bc20 |
+Content-Type: text/html
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+hey
|
|
|
34bc20 |
+</datacheck>
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+</reply>
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+#
|
|
|
34bc20 |
+# Client-side
|
|
|
34bc20 |
+<client>
|
|
|
34bc20 |
+<server>
|
|
|
34bc20 |
+http
|
|
|
34bc20 |
+</server>
|
|
|
34bc20 |
+ <name>
|
|
|
34bc20 |
+HTTP with auth redirected to HTTP on a diff port w/o auth
|
|
|
34bc20 |
+ </name>
|
|
|
34bc20 |
+ <command>
|
|
|
34bc20 |
+-x http://%HOSTIP:%HTTPPORT http://firsthost.com -L -u joe:secret
|
|
|
34bc20 |
+</command>
|
|
|
34bc20 |
+</client>
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+#
|
|
|
34bc20 |
+# Verify data after the test has been "shot"
|
|
|
34bc20 |
+<verify>
|
|
|
34bc20 |
+<strip>
|
|
|
34bc20 |
+^User-Agent:.*
|
|
|
34bc20 |
+</strip>
|
|
|
34bc20 |
+<protocol>
|
|
|
34bc20 |
+GET http://firsthost.com/ HTTP/1.1
|
|
|
34bc20 |
+Host: firsthost.com
|
|
|
34bc20 |
+Authorization: Basic am9lOnNlY3JldA==
|
|
|
34bc20 |
+Accept: */*
|
|
|
34bc20 |
+Proxy-Connection: Keep-Alive
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+GET http://firsthost.com:9999/a/path/9740002 HTTP/1.1
|
|
|
34bc20 |
+Host: firsthost.com:9999
|
|
|
34bc20 |
+Accept: */*
|
|
|
34bc20 |
+Proxy-Connection: Keep-Alive
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+</protocol>
|
|
|
34bc20 |
+</verify>
|
|
|
34bc20 |
+</testcase>
|
|
|
34bc20 |
diff --git a/tests/data/test975 b/tests/data/test975
|
|
|
34bc20 |
new file mode 100644
|
|
|
34bc20 |
index 0000000..3a4eccf
|
|
|
34bc20 |
--- /dev/null
|
|
|
34bc20 |
+++ b/tests/data/test975
|
|
|
34bc20 |
@@ -0,0 +1,90 @@
|
|
|
34bc20 |
+<testcase>
|
|
|
34bc20 |
+<info>
|
|
|
34bc20 |
+<keywords>
|
|
|
34bc20 |
+HTTP
|
|
|
34bc20 |
+FTP
|
|
|
34bc20 |
+--location-trusted
|
|
|
34bc20 |
+</keywords>
|
|
|
34bc20 |
+</info>
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+#
|
|
|
34bc20 |
+# Server-side
|
|
|
34bc20 |
+<reply>
|
|
|
34bc20 |
+<data>
|
|
|
34bc20 |
+HTTP/1.1 301 redirect
|
|
|
34bc20 |
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
|
|
34bc20 |
+Server: test-server/fake
|
|
|
34bc20 |
+Content-Length: 0
|
|
|
34bc20 |
+Connection: close
|
|
|
34bc20 |
+Content-Type: text/html
|
|
|
34bc20 |
+Location: ftp://127.0.0.1:8992/a/path/9750002
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+</data>
|
|
|
34bc20 |
+<data2>
|
|
|
34bc20 |
+data
|
|
|
34bc20 |
+ to
|
|
|
34bc20 |
+ see
|
|
|
34bc20 |
+that FTP
|
|
|
34bc20 |
+works
|
|
|
34bc20 |
+ so does it?
|
|
|
34bc20 |
+</data2>
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+<datacheck>
|
|
|
34bc20 |
+HTTP/1.1 301 redirect
|
|
|
34bc20 |
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
|
|
34bc20 |
+Server: test-server/fake
|
|
|
34bc20 |
+Content-Length: 0
|
|
|
34bc20 |
+Connection: close
|
|
|
34bc20 |
+Content-Type: text/html
|
|
|
34bc20 |
+Location: ftp://127.0.0.1:8992/a/path/9750002
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+data
|
|
|
34bc20 |
+ to
|
|
|
34bc20 |
+ see
|
|
|
34bc20 |
+that FTP
|
|
|
34bc20 |
+works
|
|
|
34bc20 |
+ so does it?
|
|
|
34bc20 |
+</datacheck>
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+</reply>
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+#
|
|
|
34bc20 |
+# Client-side
|
|
|
34bc20 |
+<client>
|
|
|
34bc20 |
+<server>
|
|
|
34bc20 |
+http
|
|
|
34bc20 |
+ftp
|
|
|
34bc20 |
+</server>
|
|
|
34bc20 |
+ <name>
|
|
|
34bc20 |
+HTTP with auth redirected to FTP allowing auth to continue
|
|
|
34bc20 |
+ </name>
|
|
|
34bc20 |
+ <command>
|
|
|
34bc20 |
+http://%HOSTIP:%HTTPPORT/975 --location-trusted -u joe:secret
|
|
|
34bc20 |
+</command>
|
|
|
34bc20 |
+</client>
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+#
|
|
|
34bc20 |
+# Verify data after the test has been "shot"
|
|
|
34bc20 |
+<verify>
|
|
|
34bc20 |
+<strip>
|
|
|
34bc20 |
+^User-Agent:.*
|
|
|
34bc20 |
+</strip>
|
|
|
34bc20 |
+<protocol>
|
|
|
34bc20 |
+GET /975 HTTP/1.1
|
|
|
34bc20 |
+Host: %HOSTIP:%HTTPPORT
|
|
|
34bc20 |
+Authorization: Basic am9lOnNlY3JldA==
|
|
|
34bc20 |
+Accept: */*
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+USER joe
|
|
|
34bc20 |
+PASS secret
|
|
|
34bc20 |
+PWD
|
|
|
34bc20 |
+CWD a
|
|
|
34bc20 |
+CWD path
|
|
|
34bc20 |
+EPSV
|
|
|
34bc20 |
+TYPE I
|
|
|
34bc20 |
+SIZE 9750002
|
|
|
34bc20 |
+RETR 9750002
|
|
|
34bc20 |
+QUIT
|
|
|
34bc20 |
+</protocol>
|
|
|
34bc20 |
+</verify>
|
|
|
34bc20 |
+</testcase>
|
|
|
34bc20 |
diff --git a/tests/data/test976 b/tests/data/test976
|
|
|
34bc20 |
new file mode 100644
|
|
|
34bc20 |
index 0000000..3b6fac7
|
|
|
34bc20 |
--- /dev/null
|
|
|
34bc20 |
+++ b/tests/data/test976
|
|
|
34bc20 |
@@ -0,0 +1,89 @@
|
|
|
34bc20 |
+<testcase>
|
|
|
34bc20 |
+<info>
|
|
|
34bc20 |
+<keywords>
|
|
|
34bc20 |
+HTTP
|
|
|
34bc20 |
+--location-trusted
|
|
|
34bc20 |
+</keywords>
|
|
|
34bc20 |
+</info>
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+#
|
|
|
34bc20 |
+# Server-side
|
|
|
34bc20 |
+<reply>
|
|
|
34bc20 |
+<data>
|
|
|
34bc20 |
+HTTP/1.1 301 redirect
|
|
|
34bc20 |
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
|
|
34bc20 |
+Server: test-server/fake
|
|
|
34bc20 |
+Content-Length: 0
|
|
|
34bc20 |
+Connection: close
|
|
|
34bc20 |
+Content-Type: text/html
|
|
|
34bc20 |
+Location: http://firsthost.com:9999/a/path/9760002
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+</data>
|
|
|
34bc20 |
+<data2>
|
|
|
34bc20 |
+HTTP/1.1 200 OK
|
|
|
34bc20 |
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
|
|
34bc20 |
+Server: test-server/fake
|
|
|
34bc20 |
+Content-Length: 4
|
|
|
34bc20 |
+Connection: close
|
|
|
34bc20 |
+Content-Type: text/html
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+hey
|
|
|
34bc20 |
+</data2>
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+<datacheck>
|
|
|
34bc20 |
+HTTP/1.1 301 redirect
|
|
|
34bc20 |
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
|
|
34bc20 |
+Server: test-server/fake
|
|
|
34bc20 |
+Content-Length: 0
|
|
|
34bc20 |
+Connection: close
|
|
|
34bc20 |
+Content-Type: text/html
|
|
|
34bc20 |
+Location: http://firsthost.com:9999/a/path/9760002
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+HTTP/1.1 200 OK
|
|
|
34bc20 |
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
|
|
34bc20 |
+Server: test-server/fake
|
|
|
34bc20 |
+Content-Length: 4
|
|
|
34bc20 |
+Connection: close
|
|
|
34bc20 |
+Content-Type: text/html
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+hey
|
|
|
34bc20 |
+</datacheck>
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+</reply>
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+#
|
|
|
34bc20 |
+# Client-side
|
|
|
34bc20 |
+<client>
|
|
|
34bc20 |
+<server>
|
|
|
34bc20 |
+http
|
|
|
34bc20 |
+</server>
|
|
|
34bc20 |
+ <name>
|
|
|
34bc20 |
+HTTP with auth redirected to HTTP on a diff port --location-trusted
|
|
|
34bc20 |
+ </name>
|
|
|
34bc20 |
+ <command>
|
|
|
34bc20 |
+-x http://%HOSTIP:%HTTPPORT http://firsthost.com --location-trusted -u joe:secret
|
|
|
34bc20 |
+</command>
|
|
|
34bc20 |
+</client>
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+#
|
|
|
34bc20 |
+# Verify data after the test has been "shot"
|
|
|
34bc20 |
+<verify>
|
|
|
34bc20 |
+<strip>
|
|
|
34bc20 |
+^User-Agent:.*
|
|
|
34bc20 |
+</strip>
|
|
|
34bc20 |
+<protocol>
|
|
|
34bc20 |
+GET http://firsthost.com/ HTTP/1.1
|
|
|
34bc20 |
+Host: firsthost.com
|
|
|
34bc20 |
+Authorization: Basic am9lOnNlY3JldA==
|
|
|
34bc20 |
+Accept: */*
|
|
|
34bc20 |
+Proxy-Connection: Keep-Alive
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+GET http://firsthost.com:9999/a/path/9760002 HTTP/1.1
|
|
|
34bc20 |
+Host: firsthost.com:9999
|
|
|
34bc20 |
+Authorization: Basic am9lOnNlY3JldA==
|
|
|
34bc20 |
+Accept: */*
|
|
|
34bc20 |
+Proxy-Connection: Keep-Alive
|
|
|
34bc20 |
+
|
|
|
34bc20 |
+</protocol>
|
|
|
34bc20 |
+</verify>
|
|
|
34bc20 |
+</testcase>
|
|
|
34bc20 |
--
|
|
|
34bc20 |
2.34.1
|
|
|
34bc20 |
|
|
|
34bc20 |
|
|
|
34bc20 |
From cf98bd64b9949c50d4726eb26745c2f7fdf3a075 Mon Sep 17 00:00:00 2001
|
|
|
34bc20 |
From: Daniel Stenberg <daniel@haxx.se>
|
|
|
34bc20 |
Date: Mon, 25 Apr 2022 17:59:15 +0200
|
|
|
34bc20 |
Subject: [PATCH 4/4] openssl: don't leak the SRP credentials in redirects
|
|
|
34bc20 |
either
|
|
|
34bc20 |
|
|
|
34bc20 |
Follow-up to 620ea21410030
|
|
|
34bc20 |
|
|
|
34bc20 |
Reported-by: Harry Sintonen
|
|
|
34bc20 |
Closes #8751
|
|
|
34bc20 |
|
|
|
34bc20 |
Upstream-commit: 139a54ed0a172adaaf1a78d6f4fff50b2c3f9e08
|
|
|
34bc20 |
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
|
|
34bc20 |
---
|
|
|
34bc20 |
lib/http.c | 10 +++++-----
|
|
|
34bc20 |
lib/http.h | 6 ++++++
|
|
|
34bc20 |
lib/vtls/openssl.c | 3 ++-
|
|
|
34bc20 |
3 files changed, 13 insertions(+), 6 deletions(-)
|
|
|
34bc20 |
|
|
|
34bc20 |
diff --git a/lib/http.c b/lib/http.c
|
|
|
34bc20 |
index 39fc7aa..d413738 100644
|
|
|
34bc20 |
--- a/lib/http.c
|
|
|
34bc20 |
+++ b/lib/http.c
|
|
|
34bc20 |
@@ -689,10 +689,10 @@ output_auth_headers(struct connectdata *conn,
|
|
|
34bc20 |
}
|
|
|
34bc20 |
|
|
|
34bc20 |
/*
|
|
|
34bc20 |
- * allow_auth_to_host() tells if autentication, cookies or other "sensitive
|
|
|
34bc20 |
- * data" can (still) be sent to this host.
|
|
|
34bc20 |
+ * Curl_allow_auth_to_host() tells if authentication, cookies or other
|
|
|
34bc20 |
+ * "sensitive data" can (still) be sent to this host.
|
|
|
34bc20 |
*/
|
|
|
34bc20 |
-static bool allow_auth_to_host(struct connectdata *conn)
|
|
|
34bc20 |
+bool Curl_allow_auth_to_host(struct connectdata *conn)
|
|
|
34bc20 |
{
|
|
|
34bc20 |
struct Curl_easy *data = conn->data;
|
|
|
34bc20 |
return (!data->state.this_is_a_follow ||
|
|
|
34bc20 |
@@ -773,7 +773,7 @@ Curl_http_output_auth(struct connectdata *conn,
|
|
|
34bc20 |
|
|
|
34bc20 |
/* To prevent the user+password to get sent to other than the original host
|
|
|
34bc20 |
due to a location-follow */
|
|
|
34bc20 |
- if(allow_auth_to_host(conn)
|
|
|
34bc20 |
+ if(Curl_allow_auth_to_host(conn)
|
|
|
34bc20 |
|| conn->bits.netrc)
|
|
|
34bc20 |
result = output_auth_headers(conn, authhost, request, path, FALSE);
|
|
|
34bc20 |
else
|
|
|
34bc20 |
@@ -1789,7 +1789,7 @@ CURLcode Curl_add_custom_headers(struct connectdata *conn,
|
|
|
34bc20 |
checkprefix("Cookie:", headers->data)) &&
|
|
|
34bc20 |
/* be careful of sending this potentially sensitive header to
|
|
|
34bc20 |
other hosts */
|
|
|
34bc20 |
- !allow_auth_to_host(conn))
|
|
|
34bc20 |
+ !Curl_allow_auth_to_host(conn))
|
|
|
34bc20 |
;
|
|
|
34bc20 |
else {
|
|
|
34bc20 |
result = Curl_add_bufferf(req_buffer, "%s\r\n", headers->data);
|
|
|
34bc20 |
diff --git a/lib/http.h b/lib/http.h
|
|
|
34bc20 |
index 1d373e8..56a6061 100644
|
|
|
34bc20 |
--- a/lib/http.h
|
|
|
34bc20 |
+++ b/lib/http.h
|
|
|
34bc20 |
@@ -252,5 +252,11 @@ Curl_http_output_auth(struct connectdata *conn,
|
|
|
34bc20 |
bool proxytunnel); /* TRUE if this is the request setting
|
|
|
34bc20 |
up the proxy tunnel */
|
|
|
34bc20 |
|
|
|
34bc20 |
+/*
|
|
|
34bc20 |
+ * Curl_allow_auth_to_host() tells if authentication, cookies or other
|
|
|
34bc20 |
+ * "sensitive data" can (still) be sent to this host.
|
|
|
34bc20 |
+ */
|
|
|
34bc20 |
+bool Curl_allow_auth_to_host(struct connectdata *conn);
|
|
|
34bc20 |
+
|
|
|
34bc20 |
#endif /* HEADER_CURL_HTTP_H */
|
|
|
34bc20 |
|
|
|
34bc20 |
diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
|
|
|
34bc20 |
index 28eaa6d..6c8faa2 100644
|
|
|
34bc20 |
--- a/lib/vtls/openssl.c
|
|
|
34bc20 |
+++ b/lib/vtls/openssl.c
|
|
|
34bc20 |
@@ -2499,7 +2499,8 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)
|
|
|
34bc20 |
#endif
|
|
|
34bc20 |
|
|
|
34bc20 |
#ifdef USE_TLS_SRP
|
|
|
34bc20 |
- if(ssl_authtype == CURL_TLSAUTH_SRP) {
|
|
|
34bc20 |
+ if((ssl_authtype == CURL_TLSAUTH_SRP) &&
|
|
|
34bc20 |
+ Curl_allow_auth_to_host(conn)) {
|
|
|
34bc20 |
char * const ssl_username = SSL_SET_OPTION(username);
|
|
|
34bc20 |
|
|
|
34bc20 |
infof(data, "Using TLS-SRP username: %s\n", ssl_username);
|
|
|
34bc20 |
--
|
|
|
34bc20 |
2.34.1
|
|
|
34bc20 |
|